Loading threat actor…
REF1695 is a financially motivated cybercrime threat cluster active since at least late 2023 that distributes malware through counterfeit software installers, frequently packaged as ISO images. The operation relies on social engineering to persuade victims to bypass Windows SmartScreen protections and execute trojanized installers that deliver multiple payloads rather than legitimate software. Associated malware includes CNB Bot, PureRAT, PureMiner, SilentCryptoMiner, and a custom .NET-based XMRig loader. REF1695’s campaigns combine remote access and cryptocurrency mining. Its tooling enables persistent access to victim systems, additional payload delivery, and long-term monetization through illicit Monero mining and CPA fraud. The malware is engineered for stealth and durability, including monitoring for security and analysis tools and suspending mining activity when such tools are opened, then resuming afterward. Reported tradecraft also includes use of a processor-access driver to support mining operations, direct system calls for evasion, disabling sleep and hibernation states to maximize mining uptime, and use of trusted platforms such as GitHub to stage payloads and reduce detection friction. Bot communications have also been protected with RSA-2048 encryption. Overall, REF1695 is best characterized as a cybercriminal operation focused on covert resource hijacking and related monetization rather than espionage or destructive activity.
42 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
9 malware families Mallory has associated with this actor across public reporting.
4 additional families tracked in Mallory.
60 indicators attributed to this actor. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.